Personal Data Breach Management: The First 72 Hours Under KVKK and GDPR

A personal data breach concerns more than information security. Legal, KVKK/GDPR compliance, management, communications, customer operations and, where needed, digital forensics teams must work under one crisis plan.

The gravest mistake is reducing all breaches to a single “72-hour rule”. KVKK and GDPR notification systems may look similar, but their legal bases and risk assessment mechanisms differ.

How does KVKK regulate breach notification?

Article 12(5) of Law No. 6698 on the Protection of Personal Data requires the controller to notify the affected person and the Personal Data Protection Board as soon as possible when others obtain the processed personal data unlawfully.

Under Personal Data Protection Board Decision No. 2019/10 of 24.01.2019, the statutory phrase “as soon as possible” means, for notifying the Board, from the time of becoming aware of the breach, without delay and within 72 hours at the latest.

If justified circumstances prevent notification within that period, explain the reasons for delay with the notification.

Is There the Same 72 Hour Rule for Notifying Interested Persons?

No. After identifying the people affected, the Board’s approach requires notifying them as soon as reasonably possible.

If the contact address of the person concerned can be reached directly; if not, appropriate methods such as announcement via the data controller's own website can be evaluated.

Board notification and communication to affected people are coordinated on one timeline, but are not subject to the same legal deadline wording.

72 Hour Rule in GDPR

Under GDPR Article 33, the controller notifies the competent supervisory authority without delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms.

If 72 hours have elapsed, the notification must also explain the delay.

The processor must inform the controller without delay after becoming aware of the breach.

Notice to the Person concerned in the GDPR

Under Article 34 of the GDPR, the data controller must inform the person concerned without delay in cases where the breach is likely to pose a high risk to the rights and freedoms of real persons.

Notification to a supervisory authority and communication to an affected individual require separate assessments under GDPR.

The First 15 Minutes: Stop the Event, Do Not Destroy Evidence

Do not instinctively shut everything down or clear logs. Contain the breach while preserving records that explain how it happened.

Identify affected systems.
Limit unauthorized access.
Rotate necessary access keys in a controlled way.
Prevent deletion of log and event records.
Record when the incident started and when it became known.

First hour: activate the data breach team

A sound incident response structure includes more than IT. Depending on the incident, involve:

Information security / IT,
KVKK or data protection leads,
legal,
management,
corporate communication,
customer operations,
external cybersecurity or digital forensics specialists.

Why does the time of awareness matter?

The 72-hour process is evaluated not from the time when the event technically first occurred, but from the time when the data controller learned of the breach. Therefore, it is important to keep initial detection, escalation and decision records within the institution.

Keeping a security alarm waiting for days without being examined can also pose a risk to process management.

Create a breach inventory

Establish the incident’s scope as quickly as possible before deciding on notification:

Which system was affected?
What data categories were affected?
How many people are estimated to have been affected?
Has the data been viewed, exported, or altered?
Are special categories of personal data involved?
Was the data encrypted or protected by other protective measures?
Is unauthorised access continuing?
What consequences might affected individuals face?

Should missing information delay notification?

The technical investigation may not be complete within 72 hours. Do not wait for every investigative step to finish before notifying.

Begin required notifications with the information available. Add details and technical findings through the relevant procedure as the analysis progresses, documenting the reasons for any delay.

How to Do Risk Analysis?

A single message sent to the wrong recipient needs a different response plan from a leak of thousands of people’s identity and financial data.

Risk analysis can consider the following factors:

the nature and sensitivity of the data,
The number of people affected,
identity theft or fraud risk,
health or other special-category data,
Whether data is made public,
protection measures such as encryption or pseudonymisation,
Whether the breach continues,
possible material or non-material harm to individuals.

How to keep technical incident records

The breach file should contain the chronology as well as the final report.

time of the first alert,
time of awareness of the breach,
The first intervention,
Identification of affected systems,
technical changes made,
The time of the notification decision,
Board/authority notification,
communications to affected individuals,
incident closure date.

Record each stage with a timestamp.

What to tell affected individuals

Do not limit communications to a vague or alarming “your data leaked”. Clearly explain the incident, affected data, possible consequences, company measures and actions individuals can take to protect themselves.

Root Cause Analysis After Violation

Reporting is not the end of event management. The institution must determine why the event took place and what controls need to change to prevent recurrence.

excessive permissions,
weak authentication,
misconfigured cloud service,
phishing,
outdated software,
human error,
Supplier Safety

Address each cause through its own corrective actions.

72 Hour Operation Plan

0-4 hours

Contain the incident, preserve evidence, establish the initial scope and record the time of awareness.

4-24 hours

Identify data categories, groups of people affected, technical cause, and possible outcomes. Include law/KVKK and management teams in the process.

24-48 hours

Prepare the notification file, list missing information, plan communication to affected individuals and begin corrective measures.

48-72 hours

Complete required authority/Board notifications under applicable law. Document any delay and its reasons. Notify affected individuals under the conditions of the relevant legal regime.

The B10 Approach

B 10 Digital Agency treats breach management beyond legal documents, coordinating data flows, permissions, logs, technical security, incident records and KVKK compliance.

Conclusion

The first 72 hours are a critical period for coordinated detection, scoping, evidence preservation, notification, communication and technical response. KVKK and GDPR require similar operational discipline, but their notification obligations must be assessed separately under their own legal provisions.

Note: This content is for general informational purposes. The legal obligations to be applied in a concrete data breach must also be assessed according to the characteristics of the incident and applicable legislation.